Drilldown: Explore vs. Triage

When you drill down from a chart into spans, logs, or web events, you can land in one of two modes — Explore or Triage. This page explains how to choose between them and points to the per-signal Triage documentation for behavior details.

Pick the Mode that Matches Your Question

For spans, logs, and web events, drilldown offers two modes — pick the one that matches the question you're asking:

• Explore opens the regular signal explorer with the chart's filters applied. Use it when you want to read the underlying records — inspect individual log lines, drill into a span tree, or scan web event payloads. This is the right choice when you already have a hypothesis and want to confirm it by looking at concrete examples.
• Triage opens the same explorer in comparative analysis mode. Use it when you want to understand what differentiates the records in your selection from a baseline — for example, which attribute values are disproportionately concentrated in this error spike? Triage surfaces the attributes (service, endpoint, customer ID, host, etc.) that distinguish the analysis group from the control group.

A simple rule of thumb:

• Show me the records → Explore
• Tell me what's different about these records → Triage

Per-Signal Triage Documentation

Triage works similarly for each signal but each explorer surfaces it slightly differently. See the per-signal documentation for comparison modes, attribute distribution semantics, and known limitations:

• Spans — Analyze Spans with Triage
• Logs — Analyze Logs with Triage
• Web Events — Filter and Group Web Events, which documents the Triage table view alongside the standard table and groups views.

When Triage Is Not Available

Triage is offered for spans, logs, and web events. It is not available for queries that target metrics directly — those drill into the Metric Explorer with the metric pre-selected and any extracted filters applied.